Introduction

Pyo is an open-source, self-hosted PaaSPlatform as a service: you hand it your code or image, and it builds, runs and serves it, so you don't manage servers by hand.. It works like a modern cloud platform, on hardware you own or rent.

Deploy anything: websites and APIs, background workers, cron jobs, databases, and services that speak plain TCP or UDP, like game servers and DNS servers. Start from a Git repository, a container image, a template or a Docker Compose file, and Pyo builds it, runs it and puts it on the web with HTTPS.

Pyo aims to be secure out of the box, without settings you have to know to turn on.

Pyo runs on k3sA lightweight version of Kubernetes, the standard system for running containers across servers. Pyo sets it up for you., but you never have to touch Kubernetes. Your services keep running if Pyo itself is down, and everything it deploys is standard Kubernetes, so you're never locked in.

Where to startCopy Anchor Link

What makes Pyo differentCopy Anchor Link

Scales and stays up

• Autoscaling on CPU and memory, with replicas spread across servers. See Scaling a service.
• Services move to a healthy server when one fails. See Making Pyo highly available.
• Several clusters, with regions. Keep traffic on the same server or within its region, or send it across all servers. See Serving traffic by region.

Secure by default

• All public traffic goes through Pyo Gateway. It's the one part every visitor reaches, so it's kept apart from your secrets and can't read your services' passwords and keys.
• The Pyo agent on your servers only has the rights it needs, and follows a policy that only you can change.
• Projects are isolated from each other by default.
• Secrets are encrypted with each team's own key, which you can keep in OpenBao or Vault.
• Sign in with passkeys, with limits on failed sign-ins, and give scripts API keys that expire.
• The team's Security page shows every protection for each of your clusters. See Securing Pyo for what to do after installing.
• A firewall for each service, by address, range or country, with rate limits.
• An optional web application firewall for each service's websites.

Sees what's happening

• Website analytics with no script to add.
• CPU, memory, disk and network for every server and service. See Monitoring your services.

Runs your databases

• Postgres, MySQL and KV, created in one click.
• High availability with automatic failover.
• Backups with point-in-time recovery. MySQL restores to any moment up to its latest backup.
• Read replicas for Postgres and KV.
• Live logs and events, and one click to connect a service.

Keeps your data safe

• Backups of volumes and databases, to the backup store built into Pyo or your own S3-compatible storage. Volume backups are encrypted.

Automates everything

• A full API, with a reference for every operation.
• The pyo CLI, for your terminal and CI.
• MCP for AI assistants. It can do everything the API can, with Read only, Deploy or Full access.

And more

• GPUs for AI models.
• External secret stores, like Vault, AWS, GCP, Azure and Doppler.
• Docker Compose import.
• TCP and UDP ports go through the gateway, with connection analytics. Turn the gateway off for a port to send its traffic straight to your service. See public TCP and UDP ports.